Skip to content
OpenAdvisories

Source

Ubuntu Security Notices (USN)

Source: https://ubuntu.com/security/notices

All Critical High Medium Low With exploited CVEs

92 results · Clear filters · Feed

  • Low max 3.5
    USN-8762-1 1 CVE

    policykit-1 vulnerability

    It was discovered that polkit incorrectly handled cookie input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service, or execute arbitrary code.

    first Sep 15, 2026
  • Low max 2.1
    USN-8137-1 1 CVE

    ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerability

    It was discovered that the Ruby URI gem did not properly handle sensitive information when combining URIs. A remote attacker could possibly use this issue to leak authentication credentials.

    first Mar 31, 2026
  • Low max 3.7
    USN-8859-1 6 CVEs

    imagemagick vulnerabilities

    It was discovered that ImageMagick did not correctly handle certain images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, …

    first Sep 30, 2026
  • Low max 2.9
    USN-8902-1 1 CVE

    libarchive vulnerability

    It was discovered that libarchive had a signed integer overflow in its ZIP writer when handling encrypted entries with sizes near the maximum value. An attacker could possibly use this issue to cause libarchive to crash or execute arbitrary code.

    first Oct 8, 2026
  • Low max 3.9
    USN-5224-1 2 CVEs

    ghostscript vulnerabilities

    It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to cause Ghostscript to crash, resulting in a…

    first Jan 12, 2022
  • Low max 3.9
    USN-5224-2 2 CVEs

    ghostscript vulnerabilities

    USN-5224-1 fixed several vulnerabilities in Ghostscript. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated sys…

    first Jan 13, 2022
  • Low max 3.3
    USN-5518-1 6 CVEs

    linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi vulnerabilities

    It was discovered that the eBPF implementation in the Linux kernel did not properly prevent writes to kernel objects in BPF_BTF_LOAD commands. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary…

    first Jul 14, 2022
  • Low max 2.9
    USN-8706-1 1 CVE

    zlib vulnerability

    It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption.

    first Aug 31, 2026
  • Low max 2.9
    USN-8720-1 1 CVE

    gnupg2 vulnerability

    It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.

  • Low max 3.3
    USN-8709-1 1 CVE

    ncurses vulnerability

    It was discovered that ncurses incorrectly handled specially crafted terminfo database entries. A local attacker could possibly use this issue to cause applications using ncurses to crash, resulting in a denial of service.

    first Sep 1, 2026
  • Low max 2.1
    USN-8692-1 1 CVE

    diffutils vulnerability

    It was discovered that GNU diffutils incorrectly handled certain integer arithmetic when mapping line ranges in diff3. A local attacker could possibly use this issue to cause diff3 to crash, resulting in a denial of service.

  • Low max 2.9
    USN-8520-1 1 CVE

    expat vulnerability

    It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service.

  • Low max 3.7
    USN-7040-2 1 CVE

    configobj vulnerability

    USN-7040-1 fixed a vulnerability in ConfigObj. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: It was discovered that ConfigObj contains regex that is susceptible to catastrophic backtracking. An attacker could p…

    first Oct 14, 2024
  • Low max 3.7
    USN-6751-1 2 CVEs

    zabbix vulnerabilities

    It was discovered that Zabbix incorrectly handled input data in the discovery and graphs pages. A remote authenticated attacker could possibly use this issue to perform reflected cross-site scripting (XSS) attacks. (CVE-2022-35229, CVE-2022-35230)

    first Apr 25, 2024
  • Low max 3.8
    USN-6169-1 1 CVE

    gsasl vulnerability

    It was discovered that GNU SASL's GSSAPI server could make an out-of-bounds reads if given specially crafted GSS-API authentication data. A remote attacker could possibly use this issue to cause a denial of service or to expose sensitive information.

    first Jun 15, 2023
  • Low max 3.5
    USN-6048-1 1 CVE

    ZenLib vulnerability

    It was discovered that ZenLib doesn't check the return value of a specific operation before using it. An attacker could use a specially crafted input to crash programs using the library.

    first Apr 28, 2023
  • Low max 3.7
    USN-5587-1 1 CVE

    curl vulnerability

    Axel Chong discovered that when curl accepted and sent back cookies containing control bytes that a HTTP(S) server might return a 400 (Bad Request Error) response. A malicious cookie host could possibly use this to cause denial-of-service.

    first Sep 1, 2022
  • Low max 3.3
    USN-4913-1 1 CVE

    underscore vulnerability

    It was discovered that Underscore incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code.

    first Apr 14, 2021
  • Low max 3.3
    USN-4704-1 12 CVEs

    libsndfile vulnerabilities

    It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-12562) It was discovered that l…

    first Jan 26, 2021
  • Low max 3.1
    USN-7818-1 1 CVE

    subversion vulnerability

    It was discovered that Apache Subversion incorrectly parsed control characters in filenames. An attacker could possibly use this issue to commit a corrupted revision to a repository, leading to a denial of service.

    first Oct 13, 2025
  • Low max 3.5
    USN-7706-1 2 CVEs

    ceph vulnerabilities

    It was discovered that Ceph incorrectly handled read-only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14662) Sergey Bobrov discovered that Ceph’s RadosGW …

    first Aug 20, 2025
  • Low max 2.8
    USN-7604-2 1 CVE

    sudo vulnerability

    USN-7604-1 fixed CVE-2025-32462 in sudo. This update provides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. Original advisory details: Rich Mirch discovered that Sudo incorrectly handled the host optio…

    first Jun 30, 2025
  • Low max 2.9
    USN-7485-1 4 CVEs

    libraw vulnerabilities

    It was discovered that LibRaw could be made to read out of bounds. An attacker could possibly use this issue to cause applications using LibRaw to crash, resulting in a denial of service. (CVE-2025-43961, CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)

    first May 6, 2025
  • Low max 3.9
    USN-7131-1 1 CVE

    vim vulnerability

    It was discovered that Vim incorrectly handled memory when closing a buffer, leading to use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service.

    first Nov 27, 2024
  • Low max 3.7
    USN-7040-1 1 CVE

    configobj vulnerability

    It was discovered that ConfigObj contains regex that is susceptible to catastrophic backtracking. An attacker could possibly use this issue to cause a regular expression denial of service.

    first Sep 26, 2024
  • Low max 3.3
    USN-6764-1 1 CVE

    libde265 vulnerability

    It was discovered that libde265 could be made to allocate memory that exceeds the maximum supported size. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service.

    first May 7, 2024
  • Low max 3.9
    USN-6257-1 1 CVE 1 exploited

    open-vm-tools vulnerability

    It was discovered that Open VM Tools incorrectly handled certain authentication requests. A fully compromised ESXi host can force Open VM Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual …

    first Jul 27, 2023
  • Low max 3.7
    USN-6142-1 1 CVE

    nghttp2 vulnerability

    Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.

    first Jun 6, 2023
  • Low max 2.5
    USN-6477-1 1 CVE

    procps vulnerability

    It was discovered that the procps-ng ps tool incorrectly handled memory. An attacker could possibly use this issue to cause procps-ng to crash, resulting in a denial of service.

    first Nov 14, 2023
  • Low max 2.6
    USN-6199-2 1 CVE

    php7.0, php7.2 vulnerability

    USN-6199-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled certain Digest authentication for SOAP. An attacker cou…

    first Oct 23, 2023
  • Low max 2.8
    USN-5103-1 1 CVE

    docker.io vulnerability

    Lei Wang and Ruizhi Xiao discovered that the Moby Docker engine in Docker incorrectly allowed the docker cp command to make permissions changes in the host filesystem in some situations. A local attacker could possibly use to this to expose sensitive informat…

    first Oct 4, 2021
  • Low max 2.9
    USN-8409-1 1 CVE

    uriparser vulnerability

    It was discovered that uriparser incorrectly handled certain URI strings. An attacker could possibly use this issue to cause uriparser to crash, resulting in a denial of service.

    first Jun 9, 2026
  • Low max 2.8
    USN-3910-2 5 CVEs

    linux-lts-xenial, linux-aws vulnerabilities

    USN-3910-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that the f2fs filesystem imp…

    first Mar 15, 2019
  • Low max 2.8
    USN-3910-1 5 CVEs

    linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

    It was discovered that the f2fs filesystem implementation in the Linux kernel did not handle the noflush_merge mount option correctly. An attacker could use this to cause a denial of service (system crash). (CVE-2017-18241) It was discovered that the procfs f…

    first Mar 15, 2019
  • Low max 3.3
    USN-8368-1 1 CVE

    libeconf vulnerability

    It was discovered that libeconf did not properly check the size of input when copying data to a buffer. An attacker could possibly use this issue to cause libeconf to crash, resulting in a denial of service.

  • Low max 1.7
    USN-8362-1 1 CVE

    xz-utils vulnerability

    It was discovered that XZ Utils did not properly manage memory when attempting to append data to a decoded index that contained no records. An attacker could possibly use this issue to cause XZ Utils to crash, resulting in a denial of service, or execute arbi…

  • Low max 3.7
    USN-2656-1 21 CVEs

    firefox vulnerabilities

    Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove …

    first Jul 9, 2015
  • Low max 3.4
    USN-2487-1 14 CVEs

    openjdk-7 vulnerabilities

    Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. (CVE-2014-3566, CVE-2014-658…

    first Jan 28, 2015
  • Low max 3.7
    USN-2673-1 10 CVEs

    thunderbird vulnerabilities

    Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove …

    first Jul 20, 2015
  • Low max 2.1
    USN-8229-2 1 CVE

    sed vulnerability

    USN-8229-1 fixed a vulnerability in sed. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: Michał Majchrowicz and Marcin Wyczechowski discovered that sed incorrectly handled symbolic links when…

    first May 28, 2026